Bug 858406 - PostgreSQL PITR setup with SELinux feature request
PostgreSQL PITR setup with SELinux feature request
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.3
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Michal Trunecka
:
Depends On:
Blocks: 873350
  Show dependency treegraph
 
Reported: 2012-09-18 18:02 EDT by Dmitry S. Makovey
Modified: 2014-09-30 19:33 EDT (History)
4 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-168.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 873350 (view as bug list)
Environment:
Last Closed: 2013-02-21 03:29:20 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Sample module outlining all the permissions required for PITR implementation with SSH and RSync (643 bytes, application/octet-stream)
2012-09-18 18:02 EDT, Dmitry S. Makovey
no flags Details

  None (edit)
Description Dmitry S. Makovey 2012-09-18 18:02:19 EDT
Created attachment 614140 [details]
Sample module outlining all the permissions required for PITR implementation with SSH and RSync

Description of problem:

Currently RHEL-shipped SELinux policy is not set up to work with PostgreSQL's PITR (point-in-time recovery). In order to apply most common methods for PITR implementation one needs to manually generate corresponding module. From information I've gathered implementation ends up being fairly similar in each case thus may warrant a tunable implemented in default policies to allow PostgreSQL to transfer WAL files to the secondary node[s]. 

In my particular case I'm implementing PGPool-II replication with PITR. (Following documentation at: http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery ). 

Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.7.19-155.el6_3.noarch
selinux-policy-3.7.19-155.el6_3.noarch

How reproducible:

Always.

Steps to Reproduce:
1. setup PGPool-II and PITR recovery as per http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery
1a. namely add to /var/lib/pgsql/data/postgresql.conf:

archive_mode = on 
archive_command = '/usr/bin/rsync %p postgres@1.2.3.4:/var/spool/pgsql/wal/%f < /dev/null'

which essentially asks postgres to send WAL files over to the secondary machine whenever it reaches checkpoint.

2. launch "psql -U postgres template1" on one of the nodes
3. => select pg_backup_start("backup_test");
4. => select pg_backup_stop()
  
Actual results:

WARNING:  pg_stop_backup still waiting for archive to complete (60 seconds elapsed)

and a lot of SELinux denials

Expected results:

operation to succeed.

Additional info:

PGPool-II used is built using SPEC file in bug #847357 which essentially is a Fedora package rebuilt and tweaked to work in RHEL
Comment 2 Miroslav Grepl 2012-09-19 08:54:53 EDT
Ok, I added a new

sepgsql_enable_pitr_implementation

boolean to Fedora. Will backport to RHEL6.
Comment 3 Miroslav Grepl 2012-09-20 02:15:56 EDT
Ok

optional_policy(`
    tunable_policy(`postgresql_can_rsync',`
        rsync_exec(postgresql_t)
    ')
')

optional_policy(`
    tunable_policy(`postgresql_can_rsync',`
        ssh_exec(postgresql_t)
        ssh_read_user_home_files(postgresql_t)
        corenet_tcp_connect_ssh_port(postgresql_t)
    ')
')

I like this solution more than was my first.
Comment 7 errata-xmlrpc 2013-02-21 03:29:20 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html

Note You need to log in before you can comment on or make changes to this bug.